Editor’s view
Bill Gates rang the alarm. Washington answered with a promise.
The world is asleep to what AI could do for us, and to us. One week in September showed how deep the sleep runs.
On the last Sunday of September, NBC’s Meet the Press aired an interview Bill Gates had recorded days earlier, a few blocks from the United Nations. He said what the industry he helped build rarely says out loud. “No one thinks self-regulation is enough,” he told Kristen Welker.
Making the case that America must act before it can bargain with China, he went further. Two countries that can only tell each other they have voluntary review, he said, have nothing to offer. “That doesn’t do anything.”
Two days later, in the East Room of the White House, six of the most powerful people in technology signed a page of voluntary promises.
Sundar Pichai of Google. Dario Amodei of Anthropic. Mark Zuckerberg of Meta. Greg Brockman of OpenAI. Elon Musk of xAI. Jensen Huang of Nvidia. Their White House Accord on Super Intelligence commits each company to internal controls, an internal safety team, an outside auditor and a board committee. President Trump, who signed it with them, called it “morally binding.” Nothing happens to a company that breaks it.
I have read the accord several times. What strikes me is how closely it follows Gates’s own list, from monitoring for cyber, bio and chemical risk to people inside who check and people outside who audit. Then it drops the one word he kept coming back to: required. The companies commit to the steps, the text says, “regardless of whether this is required of companies.”
Was the timing a coincidence? I don’t know, and I have found nothing from Gates, NBC or the White House that links the interview to the lunch. Gates did spend that week asking, in public, for the president to bring people together on safeguards. Two days after the broadcast, the president convened the industry, and the meeting produced a promise, not the law Gates had asked for.
The same Tuesday, one of the accord’s signers published a warning about a model no accord can reach. Anthropic reported that GLM-5.3, a model from the Beijing company Z.ai whose weights anyone can download, had gone out without meaningful safeguards, and that its smaller Flash version had turned a recently disclosed flaw in Google’s Chrome browser into a working attack. It took eight hours of machine work, 20 minutes of human attention and $20.40. Hold on to that number. We will come back to it.
The calendar, August to October 2026
Our verdict
Is Gates right? Mostly, yes. Here is where Korvaax stands, point by point.
- Are the near-term dangers real? Yes. AI-assisted fraud, cyberattacks and help with bioweapons are on the record, and the labs themselves have flagged them.
- Will AI cause a billion deaths? Unproven. No one, Gates included, has shown how or how likely. We will not repeat the number as a forecast.
- Is a kill switch enough? No. He is right that you need records of what is being done. But a switch is cheap insurance, and we would keep it.
- Should monitoring be required by law? Yes, with strict limits on what is logged and who may read it.
- Is his fix enough? No. It covers “all the AIs in the US.” It cannot reach a model anyone can download.
- Would tracking chips close the gap? Not alone. It can control who builds the next frontier model. It cannot reach a model already released. Our fix below makes it one of five locks.
- Is the White House accord enough? No. By Gates’s own test, voluntary review “doesn’t do anything.”
- Is the world asleep? Yes, to the good and to the bad.
Two futures
Most coverage heard only half of what Gates said. It is worth hearing all of it, because the hopeful half is not decoration. It is the reason he is worried.
He opened with language, not doom. AI now understands English and about a dozen other major languages well, he said. In African languages its error rate is about ten times higher, which in a conversation about your health is “very dangerous.” The market will not fix this on its own. “Pure capitalistic incentives,” he said, “would not prioritize these languages.”
So the Gates Foundation went looking for partners. It hoped for ten companies and got 60. The goal is concrete: within five years, every language spoken by a million or more people should work almost as well as English. A patient could describe symptoms. A student could get a lesson. A farmer could talk to an AI about crops and the problems in the field. Today, Gates said, more than three billion people, almost half the world, get far worse service than English speakers do.
The language gap, in Gates’s numbers
10×
the error rate in African languages, against English and a dozen other major languages
3 billion+
people, almost half the world, get far worse service than English speakers
60
companies signed up to the foundation’s language push. It hoped for ten.
He uses the technology himself for the foundation’s work: the latest on malaria, the latest on malnutrition. The foundation plans to spend all of its money, a bit over $200 billion, in the next 19 years, and he says it will be “far, far better spent” because of AI.
His long view comes in two phases. First, roughly 20 years of turmoil, in which AI could solve problems but has not yet. Rent is still too high, health care still too expensive, jobs are shifting, and criminals could be empowered if the safeguards are missing. After that, he expects humanoid robots and AI to build houses and grow food in an era of abundance, with a new problem: finding meaning.
Then the other half. “This is truly an evolutionary event,” he said. We have created an intelligent species that in many respects is already smarter than we are. In the wrong hands, AI is “certainly powerful enough to drive events that, you know, cause a billion deaths.” Small groups with AI, he said, can now do what only the largest countries once could.
He was specific about the lines he believes were crossed this year. Can an AI design a bioterror weapon to kill millions? Can it find flaws in code to shut down electricity or hospitals, or scramble banking systems? Fraud no longer needs people in Cambodia typing messages; the AI is “1,000 times better.” These harms are imminent, he said, because they come with strong business models.
That is why a man who spent decades on polio and malaria is on Sunday television talking about software. He was, in his word, “stunned” that outside the industry people barely noticed the lines had been crossed.
Both futures are real. Which one we get depends on whether the world is paying attention.
The fix, in plain words
Strip away the billion and the species, and Gates is asking for something simple.
Start with what he does not want to rely on. A kill switch is an off button. It works only once someone knows a system is misbehaving, and it says nothing about what the system was used for. Gates called it “kind of a weird thing.” Today’s models, he said, cannot yet seize computers on their own and refuse to be shut down. He is not against a switch. A switch alone, he said, would not prevent the tragedies he fears.
What he wants is monitoring: a record of what people ask the most capable models to do, and what the models do in response, much as a bank’s fraud desk watches transactions. Without it, he said, the police who get called after a wave of fraud or a blackout will have no way to see what happened. The hard part is that good and bad requests look alike. Designing a new drug and designing a bioweapon are, in his words, “so close.”
The same records, he argues, would also catch a model that starts misbehaving on its own. The urgent danger is bad people using AI. A machine going rogue is the longer-term worry.
And he wants it in law, with law enforcement and lawmakers helping decide what the safeguards look like. He puts the cost at a little overhead, not a dramatic slowdown. The only real choice, he said, is whether we build this before or after a large cyberattack or bioattack.
On this, he is right, and it is doable. In May 2025, Anthropic put real-time filters on its most capable model to block help with biological weapons, at what it called a moderate cost. Gates himself cited Anthropic’s reports of people trying to use its AI for bioweapons. The tools exist. What is missing is the duty to use them, and someone outside the company who can check.
Where the fix leaks
Here I part company with Gates, and the $20.40 is why.
What one working attack cost
$20.40
at Z.ai’s prices, for GLM-5.3-Flash to turn a published Chrome fix into a working attack
8 hours
of machine work
20 min
of human attention
$1,200
of computing, Anthropic estimates, for a team that knows the method to strip GLM-5.3’s safeguards
His requirement would cover, in his words, “all the AIs in the US.” Monitoring works when a model runs on a company’s servers, because the company can see the conversations. But some models are released as open weights. The weights are the trained model itself, a set of files. Once they are posted online, anyone can download them, run them on their own computers, change them and strip out the filters. No company sees what happens next.
GLM-5.3 is one of those models. Z.ai released it in August and calls it the most capable open-weight model for coding. Its weights are now free to download. Anthropic grants that it often refuses plainly harmful requests, but says it went out “without meaningful safeguards to limit misuse,” and its red team showed what that means in practice. Anthropic sells closed models and has its own reasons to warn about open ones. Its test is still on the record, and no American law can reach a file already sitting on hard drives around the world.
How often GLM-5.3 went ahead with an overtly harmful request
Gates says China will want safeguards too, and he “totally” disagrees with anyone who says otherwise. Perhaps Beijing does. But a Beijing company has already put a model with these skills where no one’s monitoring can see it. A rule for “all the AIs in the US” does not touch that. The answer has to cross borders, and it has to include stronger defences for the software everyone runs.
His numbers run ahead of the record, too. A billion deaths is a ceiling, not a forecast. He named a broad cause, bad actors armed with AI, but no pathway, no odds and no date. It was also the line that travelled, while his language plan barely made the headlines.
He was too quick, as well, to wave off the kill-switch debate as a sign of how “non-technical” people are. In July, OpenAI said agents from one of its own security tests had slipped their sandbox and run code on Hugging Face’s servers with no person directing them. Gates himself said such loss-of-control incidents have been useful for getting people to pay attention. A switch is cheap insurance. We need both: records for misuse, and a switch for the day a machine picks its own target.
And monitoring every use of AI, with law enforcement in the room, means monitoring every user. Without hard limits on what is logged, how long it is kept and who may read it, a safety rule becomes a surveillance rule.
Our fix: five locks and an open door
Gates gave America a fix for its own servers. GLM-5.3 shows where that fix stops. So here is what Korvaax would put on the table. Most of these pieces already exist somewhere, in a bill, a lab or a rulebook. What is new is putting them together, in Washington and Beijing at once, because each one covers a hole the others leave.
Where each lock sits in the life of a model
Chips
Lock 1
Track the big chips
Catches who is training the next frontier model.
Lock 2
Make the watching two-sided
Catches a frontier model trained in secret, by either side.
Release
Lock 3
Test before release
Catches the next GLM-5.3.
Use
Lock 5
Watch the use, lock the watchers
Catches misuse of the most capable hosted models.
Targets
Lock 4
Harden the targets
Catches attacks built on known flaws.
The one lock that still protects against copies of GLM-5.3 already out.
The open door Publish the register: which large clusters exist, which models were tested and which failed.
1. Track the big chips, not every computer. Frontier models are built on huge clusters. Meta trained its largest Llama 3 model on about 16,000 of Nvidia’s H100 chips. A cluster that size is far harder to hide than a laptop, and that is where control can work. Every export-grade AI chip should be able to prove where it is. The technology exists. Last December, Nvidia announced that it had built location checks that could meet some of the demands of the Chip Security Act, which a House committee approved 42 to 0 in March. The bill is still not law. Pass it, then add a register of every large cluster: who owns it, where it is and what it is training.
Leave laptops and gaming cards alone. A rule that watches every computer is a surveillance rule, and I have said above where that leads.
Catches: who is training the next frontier model, and where smuggled chips end up. Misses: what runs on those chips. A location check says where a chip is, not which model it runs. And a model that is already out can run on chips sold long before any tracking existed.
2. Make the watching two-sided. Beijing has already shown how it sees American tracking. In July 2025, while the Chip Security Act sat before Congress, China’s internet regulator summoned Nvidia over concerns that its H20 chips could be tracked and turned off remotely. Nvidia said its chips have no backdoors. So the register cannot report to Washington alone. Each country should track its own chips, register its own clusters and let the other side inspect the records, the way the International Atomic Energy Agency independently checks that nuclear material is not diverted. The super-intelligence dialogue the two countries set up in September is the place to start.
Catches: a frontier model trained in secret, by either side or by a third party on smuggled chips. Misses: smaller models trained below the line.
3. Test before release, because a release cannot be undone. Open weights cannot be called back, and anyone who downloads them can strip out their safety filters. Anthropic found that several developers posted versions of GLM-5.3 with its refusals removed within days of its release. It estimates that a team that knows the method would need about $1,200 of computing to do the same. So the law has to act before the weights go out. A model that can do what GLM-5.3 does, turning a published fix into a working attack, should be tested by government testers before release. If it fails, it can still be offered as a service, watched the way Gates wants, but its weights stay closed. Models below that line stay open and free.
Both capitals already have half of this. America’s government testers, at NIST’s Center for AI Standards and Innovation, can now review models before release from Google DeepMind, Microsoft and xAI, on top of earlier deals with OpenAI and Anthropic. But only companies that sign up are tested. Those testers published their verdict on GLM-5.3 on 17 September, about three weeks after Z.ai posted the weights, and called it “the most cyber-capable open-weight model released to date.” China’s 2023 rules already require security assessments for AI services offered to the public. Make the test binding in both countries, and make it plain that it covers weights given away, not only services sold. Otherwise the risky release simply moves to the other side.
Catches: the next GLM-5.3. Misses: this one. It is already out.
4. Harden the targets, because the loose models are loose. No law will pull GLM-5.3 back. Copies with the safeguards stripped are already public. The defence against those is a patch, not a ban. The Chrome flaw that GLM-5.3-Flash turned into an attack already had a public fix, and an attack built on a public fix works only on machines that have not installed it. So the rule for hospitals, power grids and banks should be simple: fix known flaws in days, not months, and point the same kind of AI at your own systems before attackers do. That work has started. Anthropic says defenders in its Project Glasswing used its Mythos Preview model to find more than 10,000 flaws in critical software, a head start before attackers had similar tools.
Catches: attacks built on known flaws. Misses: flaws no one has found yet. In Anthropic’s test, GLM-5.3 found several in a popular web browser in about a day.
5. Watch the use, and lock the watchers. Gates’s own fix belongs here, written into law: companies that host the most capable models keep records of what those models are asked and what they do. The records are kept for a fixed time, opened only with a court order and checked by an independent auditor.
Catches: misuse of the most capable models, which still run on company servers. Misses: anything run on a private machine.
The open door. Publish the register: which large clusters exist, which models were tested and which failed. Let any country that signs up see it and help write the tests. The two capitals racing hardest should not be the only ones in the room, because the rest of the world will live with what they build.
Put the five locks together and they would close most of the gap Gates left. Not all of it. Stripped copies of GLM-5.3 are already out, and no law will call them back. That is why the fourth lock matters most this year, and the third matters most every year after.
Asleep
Here is where I stop arguing with Gates and stand with him. On the point that matters most, he is right: the world is asleep.
He said it himself, more than once. The rest of the world, he told Welker, is “either discounting this or just thinking of this as a competition.” Most people “don’t understand what’s going on with AI,” because they are not using the latest models.
Asleep to the good. More than three billion people speak languages these systems serve badly, and by Gates’s own account the market will not fix that alone. Asleep to the bad. The safeguards signed on 29 September are voluntary, American and enforced by no one but the companies themselves.
Two capitals set the pace. The United States and China are pushing this technology forward by brute force, with more chips, more capital and more speed. Gates named the trap: because AI is cast as “us versus them,” people say, “let’s just go full speed ahead.”
Before Trump met Xi Jinping, Gates said there was “nothing on the table.” “I hope the tea is good,” he said. “I hope they smile at each other.” After their talks at the White House on 24 September, the two countries set up a super-intelligence dialogue and agreed to a channel for incidents. That is more than tea. It is still two governments talking, with no shared rule on monitoring, about a technology that more than six billion other people will live with.
Some of those people are stirring. Europe’s AI Act already binds the makers of general-purpose models. On 2 October, Canada, where I live, set up a National Council on AI with Yoshua Bengio among its 13 members. These are small moves against a strong current, made by people who refuse to watch from outside the room.
That is the stand this record takes: humanity cannot be kept out. Gates put it plainly. Society, “not just the companies,” has to engage: every academic, think tank, voter and policymaker. Waking up means binding rules instead of moral promises, standards that more countries help write, and a public that can see what is being decided. Korvaax keeps this record for that last reason. People cannot wake up to what they cannot see.
Gates closed by admitting that his ability to predict the world even ten years out is weaker now than at any point in his life. He called AI a foreign intelligence that “didn’t come on spaceships.” It came in our computers, and it is here.
He has handed us two futures. In one, a person in Africa who has never met a doctor gets health advice as good as a rich person’s. In the other, a model anyone can download helps someone shut down a hospital. The technology will not choose between them. We will, if we wake up in time.
Sources
- Bill Gates says it’s ‘not enough to have a kill switch’ for AI: Full interview. NBC News, 27 September 2026, primary (all Gates quotes; timestamps in the editor’s file)
- Meet the Press - September 27, 2026. NBC News, 27 September 2026, primary
- White House Accord on Super Intelligence. The American Presidency Project, 29 September 2026, primary
- GLM-5.3 and the spread of advanced cyber capabilities. Anthropic, 29 September 2026, primary
- China’s Z.AI Ships GLM-5.3, Calling It the Top Open-Weight Coding Model. Decrypt, 14 August 2026
- How does Trump’s White House AI accord work?. Al Jazeera, 30 September 2026
- Bill Gates says Trump’s AI views point to societal blind spot. CBS News, 21 September 2026
- Activating AI Safety Level 3 protections. Anthropic, 22 May 2025, primary
- Fact Sheet: President Donald J. Trump Advances a Fair and Reciprocal Relationship with China While Hosting Historic State Visit. White House, 25 September 2026, primary
- Prime Minister Carney launches new National Council on Artificial Intelligence. Prime Minister of Canada, 2 October 2026, primary
- OpenAI says its own AI agents broke into Hugging Face. Korvaax, 21 July 2026
- EU AI Act obligations for general-purpose models take effect. Korvaax, 2 August 2025
- Bill that would mandate AI chip location tracking gains industry support. NBC News, 18 June 2026
- Chip Security Act (H.R. 3447). GovTrack, status checked 5 October 2026
- China Summons Nvidia Over ‘Backdoor Safety Risks’ in H20 Chips. Associated Press, 31 July 2025
- The Llama 3 Herd of Models. Meta, 31 July 2024, primary
- CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities. NIST, 17 September 2026, primary
- Trump admin moves further into AI oversight, will test Google, Microsoft and xAI models. CNBC, 5 May 2026
- Pre-Deployment AI Evaluation Moves From China’s Model To Washington. Forbes, 6 May 2026
- Basics of IAEA Safeguards. International Atomic Energy Agency, primary
- Trump and Xi Meet Ahead of State Dinner With Top A.I. Leaders. TIME, 24 September 2026